Chapter 8 Flashcards
Identities
The collection of user information, credentials, rights, roles, group memberships, and other attributes and information about individuals and accounts—are among the most critical assets that an organization owns. Identities, and the access and rights that we grant to them, provide the keys to systems, services, and data, making them targets for both internal and external attackers.
Authenticatiion, Authorization and Accounting
Framework that is used to control access to computers, networks, and services. AAA systems authenticate users by requiring credentials like a username, a password, and possibly a biometric or token-based authenticator. Once individuals have proven who they are, they are then authorized to access or use resources or systems.
IAM
IAM systems are built to create, store, and manage identity information as well as the permissions, groups, and other information needed to support the use of identities.
Directory Services
Are used in networks to provide information about systems, users, and other information about an organization.
LDAP
Commonly deployed as part of an identity management infrastructure and offer hierarchically organized information about the organization
Organizational Units (OUs)
Security & Human Resources. Each of these units includes a number of entries labeled with a Common Name (CN)
TACACS+
A Cisco-designed extension to TACAS, the Terminal Access Controller Access Control System. It uses TCP traffic to provide authentication, authorization, and accounting services. TACACS+ suffers from a number of flaws, including a lack of integrity checking for the data it sends, allowing an attacker with access to the traffic it sends to make arbitrary changes or to use replay attacks against the TACACS+ service. TACACS+ also has encryption flaws that can lead to compromise of the encryption key. This means TACACS+ systems that provide AAA services for network devices should operate on an isolated administrative network if possible.
RADIUS
The Remote Authentication Dial-in User Service, is one of the most common AAA systems for network devices, wireless networks, and other services. RADIUS can operate via TCP or UDP and operates in a client-server model. RADIUS sends passwords that are obfuscated by a shared secret and MD5 hash, meaning that its password security is not very strong. RADIUS traffic between the RADIUS network access server and the RADIUS server is typically encrypted using IPSec tunnels or other protections to protect the traffic.
Kerberos
Which unlike TACACS+ and RADIUS, is designed to operate on untrusted networks and uses encryption to protect its authentication traffic. Users in Kerberos, called principals, are composed of three elements: the primary (frequently the username), the instance (used to differentiate similar primaries), and the realm, which consists of groups of principals. Realms are often separated on trust boundaries and have distinct key distribution centers (KDCs). Figure 8.3 shows the basic Kerberos authentication flow.
SSO
Many web applications rely on single sign-on (SSO) systems to allow users to authenticate once and then to use multiple systems or services without having to use different usernames or passwords.
Share Authentication
Shared authentication schemes are somewhat similar to single sign-on and allow an identity to be reused on multiple sites while relying on authentication via a single identity provider. Shared authentication systems require users to enter credentials when authenticating to each site, unlike SSO systems.
OpenID
An open source standard for decentralized authentication. OpenID is broadly used by major websites like Google, Amazon, and Microsoft. Users create credentials with an identity provider like Google; then sites (relying parties) use that identity.
OAuth
An open authorization standard. OAuth is used by Google, Microsoft, Facebook, and other sites to allow users to share elements of their identity or account information while authenticating via the original identity provider. OAuth relies on access tokens, which are issued by an authorization server and then presented to resource servers like third-party web applications by clients.
OpenID Connect
Is an authentication layer built using the OAuth protocol.
Facebook Connect
Also known as Login with Facebook, is a shared authentication system that relies on Facebook credentials for authentication.
Role-Based Access Control (RBAC)
Uses roles associated with job functions or other criteria. Roles are matched to permission sets appropriate to those roles, and then users or other objects like a system or software package are assigned role. Constraints are: uses roles associated with job functions or other criteria. Roles are matched to permission sets appropriate to those roles, and then users or other objects like a system or software package are assigned role; Subjects can use permissions only if the subject’s active role is authorized to use it; The subject’s active role must be one it is authorized to have.
Attribute-Based Access Control (ABAC)
Gives users rights based on policies. Policies use collections of attributes to determine which access rights to grant, thus building logic-based collections of rights. ABAC tends to be used when a flexible, context-sensitive access control model is required. Combining attributes that describe the subject (like their role, division, or other personal attributes), the action they are trying to perform, attributes of the object that they are attempting to access or use, and environmental attributes like time of day or location allows complex access control logic with fine-grained control.
Mandatory Access Control (MAC)
Systems rely on the operating system to control what subjects can access and what actions they can perform. Due to this design, MAC usually relies on a system administrator to implement access control policies. Since it is relatively rigid, MAC implementations have typically been associated with military systems, although an increasing number of operating systems and security packages implement MAC capabilities.
